CVE-2026-85209: Missing Authorization

Missing Authorization vulnerability in AVEZ Electronics Communication Training and Consultancy Trade Inc. Learning Management System LMS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Learning Management System LMS: through 2026-09-18...

CVE-2026-51916

TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in deleteuserknowledge in superagi/controllers/knowledges.py. In affected source snapshots, POST /knowledges/delete/knowledgeid deletes the selected knowledge object without requiring authentication in the rout...

CVE-2026-51914

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control within the agent template controller. The functions save_agent_as_template and publish_template in superagi/controllers/agent_template.py accept caller-supplied agent_id or agent_execution_id values without verifying if...

EUVD-2026-91759

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the agent template controller. In affected source snapshots, saveagentastemplate and publishtemplate in superagi/controllers/agenttemplate.py accept caller-supplied agentid or agentexecutionid values and do not verif...

PT-2026-104302

Missing Authorization vulnerability in AVEZ Electronics Communication Training and Consultancy Trade Inc. Learning Management System LMS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Learning Management System LMS: through 2026-09-18...

CVE-2026-13413: Improper Access Control

The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.20 does not correctly restrict access to the site while maintenance/coming-soon mode is enabled, allowing unauthenticated visitors to bypass the coming-soon page and reach the otherwise hidden site, including hidden published pages, ...

Gitea Data Compromise

The vulnerabilities in the files routers/api/v1/api.go, routers/api/packages/api.go, services/context/api.go, and services/context/permission.go of the Git repository management system Gitea are related to access control deficiencies. Exploiting these vulnerabilities could allow a malicious actor...

Gitea API Disclosure Sensitive Information

The vulnerability of endpoints /api/v1/user/orgs and /api/v1/users/username/orgs/org/permissions in the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...

Gitea DeleteIssueLabel Function Information Disclosure

The vulnerability of the DeleteIssueLabel function in the routers/api/v1/repo/issuelabel.go file of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information that is protected...

Gitea ToHook Function Information Disclosure

The vulnerability of the ToHook function in the services/webhook/general.go file of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information that is protected by this functio...

Gitea handleOAuth2SignIn OAuth2 Bypass

The vulnerability of the handleOAuth2SignIn function in the routers/web/auth/oauth.go file of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow an attacker to compromise the confidentiality and integrity of the protecte...

Gitea IntrospectOAuth Disclosure

The vulnerability of the IntrospectOAuth function in the routers/web/auth/oauth2provider.go file of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...

Gitea API Endpoint Protected Information Exposure

The vulnerability of the endpoint /api/v1/teams/teamid of the Gitea Git repository management system is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...

Gitea UpdatePullRequest Function Use-After-Free

The vulnerability of the UpdatePullRequest function in the routers/api/v1/repo/pull.go file of the Git repository management system Gitea is related to insufficient resource control during its existence. Exploiting this vulnerability could allow a malicious actor to compromise the integrity and...

CVE-2026-51904

SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller. In affected source snapshots, createagentexecution and createagentrun in superagi/controllers/agentexecution.py accept a caller-supplied agentid and fail to verify that the referenced agent...

CVE-2026-51915

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control within the tool controller. Specifically, the get_tool and update_tool functions in superagi/controllers/tool.py accept a caller-supplied tool_id but fail to verify if the organization owns the associated toolkit. This ...

SUSE SLED15 / SLES15 Security Update : alloy (SUSE-SU-2026:4408-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4408-1 advisory. - CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error...

ROS-20261002-73-0135

The vulnerability in Xen is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to enhance their privileges...

tomcat: Apache Tomcat: Security constraint bypass due to improper access control

A flaw was found in Apache Tomcat. This improper access control and incorrect authorization vulnerability allows an attacker to bypass security constraints. This occurs when a security constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path, potential...

tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing

A flaw was found in Apache Tomcat. An off-by-one error in the RewriteValve's N flag processing causes rewrite rules to restart at the second rule instead of the first. This vulnerability may allow an attacker to bypass intended access controls...